[M] EXPIRATION_TIME constant will not apply across contests deployed on different chains, leading to unfair distribution of prizes
Summary
During the call to deployProxyAndDistributeByOwner the contract checks if the contest has expired,
before deploying the proxy and distributing the prizes.
The EXPIRATION_TIME constant is set to 7 days.
Vulnerability Details
However, since chains like Polygon, Optimism, Arbitrum, and BSC have a faster block time than Ethereum,
its very possible that block.timestamp will be greater than the EXPIRATION_TIME constant.
Impact
If this happens, this condition might not be met and prizes will be distributed to winners prematurely, before
other participants have had a chance to submit their solutions.
Tools Used
Manual Review
Recommendations
You could use an Oracle to get the current block.timestamp across the desired chains of deployment.
Then use the Oracle to check the current block timestamp before ascertaining if the contest has expired.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.